Keycloak Admin REST API Improper Access Control Vulnerability Allowing Sensitive Role Metadata Disclosure

A vulnerability exists in the Keycloak Admin REST API due to improper access control on the roles endpoint within the admin realms. This flaw allows remote authenticated attackers with high privileges to access sensitive role metadata, including names, IDs, and internal identifiers of administrator-created roles. The unauthorized disclosure of this information could be exploited to map privilege structures and plan targeted privilege escalation attempts, thereby impacting the confidentiality of Keycloak deployments.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive role metadata, which could be used to map privilege structures and plan targeted privilege escalation attempts within Keycloak.